Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.4146 virt-manager security, bug fix, and enhancement update 6 November 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: virt-manager Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 8 Red Hat Enterprise Linux WS/Desktop 8 Linux variants Impact/Access: Access Confidential Data -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2019-10183 Original Bulletin: https://access.redhat.com/errata/RHSA-2019:3464 Comment: This advisory references vulnerabilities in products which run on platforms other than Red Hat. It is recommended that administrators running virt-manager check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Low: virt-manager security, bug fix, and enhancement update Advisory ID: RHSA-2019:3464-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:3464 Issue date: 2019-11-05 CVE Names: CVE-2019-10183 ===================================================================== 1. Summary: An update for virt-manager is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - noarch 3. Description: Virtual Machine Manager (virt-manager) is a graphical tool for administering virtual machines for KVM, Xen, and Linux Containers (LXC). The virt-manager utility uses the libvirt API and can start, stop, add or remove virtualized devices, connect to a graphical or serial console, and view resource usage statistics for existing virtualized guests on local or remote machines. The following packages have been upgraded to a later upstream version: virt-manager (2.2.1). (BZ#1727881) Security Fix(es): * virt-install: unattended option leaks password via command line argument (CVE-2019-10183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1599139 - RFE: Support genid in virt-manager 1659354 - video devices should be removeable when vm has more than one video devices 1660123 - No spice channel is added for Windows guests 1660467 - Can create a new vm with the MAC address in use on rhel8.0 1661867 - Cannot add a new virtual network: SR-IOV VF pool on rhel8 1666597 - Cannot enable or disable system tray icon 1667025 - Cannot modify guest's name on uefi firmware when creating new vm on rhel 8 1671599 - 'Allocation' under Storage volume quota for qcow2 format volume is redundant 1679018 - RuntimeError: Path does not exist: /var/lib/libvirt/qemu/nvram/test_VARS.fd 1683609 - [RFE] virt-install should add input devices when graphics are enabled 1690685 - Fail to force clone an empty cdrom device 1690687 - Fail to update graphic listen type by virt-xml 1692489 - virt-install fails with "Storage pool not found: no storage pool with matching name 'default'" 1700354 - warn if use of secboot UEFI will overwrite machine to q35 1707379 - virt-install with --sysinfo type=random-string silently defaults to smbios 1709857 - RFE - Ability to add IBPB feature policy to mitigate Spectre v2 for VM guests 1714304 - virt-install --os-variant rhel7 causes stack trace 1718065 - Drop virt-convert from rhel8 1722820 - missing gtksourceview3 dependency 1724287 - Using --wait 0 option in virt-install will return with exit code 1 1726232 - CVE-2019-10183 virt-install: unattended option leaks password via command line argument 1727811 - WARNING Changing machine type from '%s' to 'q35' which is required for UEFI secure boot 1727881 - Rebase virt-manager to current upstream release 1741846 - virt-install man page typo issue for "--launchSecurity" option 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: virt-manager-2.2.1-2.el8.src.rpm noarch: virt-install-2.2.1-2.el8.noarch.rpm virt-manager-2.2.1-2.el8.noarch.rpm virt-manager-common-2.2.1-2.el8.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-10183 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIUAwUBXcHprdzjgjWX9erEAQgtcA/4zzBlgY4u903iiXL1kzzlmZbCWdiH3OXy SGwW90MIjBTrToaUQ1Ix1y9cdDYqaUM+tlYwNy8tC7El/nULW+Le2M5BNxc9iAce fIF6Sqlut+nZkFxP5q5kxndZMrPzqLZAGO9sP1p+Ma6P4IxHmMB7+z/0qRwbQHD+ Iz2M+mxm3EunPZYF330zoYAj2udBDLPNKV4c2JVauz1DzOkfihdUXyjr/k9/Shee VUoIuBDk7Tk3WWlRdp/iRk9osQYwERP068lr19hfVSA0npHTM08WgV/4N097/1Fb fFMYvbQD+et2yO8tdcqoScBjC/c2usVw7iEJts9xpZM/TD3CJ0wBBEoNh7b/S72o fEqGBsmt5R/AT3r85JeWYwnFHCyQlL/e8CIigMufSZKdCYku51LDn2s8AixtSC3Y JB8URmw40omu0ETz2W/nhIOpUh8tq1hEIjD8RxwmS5KKz6WKUPmCkQbo5W0U54vA ecRtXLYGr9+zJvO1XLBT4HDZgUtQa/zA5ZOPB5sK9SKiTgP/dPgSc/FmgWGnqjNs QEgxFwOThuiO6UoQamOAJ6ZzGtjVgZNg4ppMNXjmiz/qfujF3yG9pnkGPhdcPl78 rYhvjgMmsjzM5Op1hsN2QV3bJ6P4xmEwdSsehEbc4tPtB6ag3cUmK7VxJCjTiN2i FRy1Z1FmdQ== =5uBQ - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXcJGQ2aOgq3Tt24GAQhWLRAAnD7D70TcJZhbuNuXexL93xUTq6d/Pcgh 3M8C0D2dfKMuFNGBagLAHHa0O33UK8PFYGGiesjgvnhDDEG+phHBEwV2oDjE+1a9 RlltJjxjfHPX3gkaPwTy9chxk1HN4l7mcTIPtErynWXnw3LP4phe4QHxd7NEu4H5 ASG9Va+fh4qNCUm7IXFrGZC7GIoOnCA2+I0PWBJPMYjuwNZo0yJsYxqgEBMfdY/N c9arqBy27aGO8Dr5YwAuIbLga380FTVmuxmKep106NTQjyVDgTTPwws2EEEHlNas JSVcRdOVQ39xUZaNnw8IrlX/ze0Q/Gc+NT+4dV1/SSUtjjka6xbgdSQyFW1C9G4b r5uNdbjWcuDire1hiOYcz6NfFoQ8FToeavNN0Ut80o8toCCX3om31KCJNa7/thBz qrzzcx1ElQ9ksp1bR30qM1zDVfNUPKDLVxN5TtKQsbN2LjOstNlqwuFBUFcmERuA Z8SmCOOh8vbSTx4JvnMD3BiJ+Tjf6ahV96wOkdqrYxw0XKk7jxbppoEjl9Gm33D9 owFHiSbtcwr5Uzym1LE1plLksXWar5N1Np57fAi/z/SN2q8y1H5/Vmh9Orq/iPjN pwODTh+Qix9Nd351CDHlxxIwJCQm3EzVhzW+x8pG7FECuQQ9iVQGcOxqV9KGQp0o gD5awiZnYAY= =jKAq -----END PGP SIGNATURE-----